----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
IBM WebSphere Application Server Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA33022

VERIFY ADVISORY:
http://secunia.com/advisories/33022/

CRITICAL:
Less critical

IMPACT:
Unknown, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
IBM WebSphere Application Server 7.0.x
http://secunia.com/advisories/product/20679/

DESCRIPTION:
Some vulnerabilities have been reported in IBM WebSphere Application
Server, where some have an unknown impact and others can be exploited
by malicious people to disclose potentially sensitive information.

1) An unspecified error exists when handling JSP files on Microsoft
Windows Server. No further information is currently available.

2) The problem is that SSL traffic is routed over unencrypted TCP
connections. No further information is currently available.

3) An unspecified error related to "userNameToken" exists in Feature
Pack for Web Services. No further information is currently
available.

The vulnerabilities are reported in IBM WebSphere Application Server
version 7.0.0.

SOLUTION:
Apply Fix Pack 1.
http://www-01.ibm.com/support/docview.wss?uid=swg24021073

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
IBM (PK67282, PK74777, PK75248):
http://www-01.ibm.com/support/docview.wss?uid=swg27014463

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------